Limit message length

[smarechal]

Hello,

How can i limit the nuber of character displayed in the message field?

Thank you.

[tinylund]

eval Message=split(Message,".") | eval Short_Message=mvindex(Message,0) Gives the first sentence of the Windows Message field. Split divides the Message field by sentences (split at each period "." - the second command populates the first sentence (0) into the field called "Short_Message"

[MelCharley]

I'm very new to Splunk so forgive me if this isn't the best method available. I too was having this issue with limiting the length/size of Messages from Windows 2008 Security Logs. The work answer for me was to use the regex creation tool.

• Take a sample event and use the field extractor function. (Little drop down arrow in the top left corner.)
• This will open a new tab for Extract fields.
• In the sample events highlight the message that you are wanting to see and past this into the "Example values for a field:"
• Generate the regex then rename it as something more user friendly.

Again this may be a beginner stuff but it worked for me!

[smarechal]

Yes limit value of a field. For exemple the message field is very long for some Messages, is it possible to limit the display?

Thank you.

[Drainy]

What message field? Are you talking about limiting the value of a field?